Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 12:31

General

  • Target

    4a872d9e1a0aed550ed12f4268c1cb0f89ef17509dd7de2f98c59685fb6d63e1.exe

  • Size

    29KB

  • MD5

    e5fd63a404de047a53f753615901eae1

  • SHA1

    10714a9ad626db5f1daf3e682b91670a27026366

  • SHA256

    4a872d9e1a0aed550ed12f4268c1cb0f89ef17509dd7de2f98c59685fb6d63e1

  • SHA512

    67f62f7ec381b52cac459c60f4e8b0393627049d6736b21f543a1f8b0ea5f98803cedcf14d7e7871796d64fdaf9a51b45b7b4d9898a166b7b6759177304d917d

  • SSDEEP

    768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/1hh:AEwVs+0jNDY1qi/qt7

Malware Config

Signatures

  • Detects MyDoom family 5 IoCs
  • MyDoom

    MyDoom is a Worm that is written in C++.

  • Mydoom family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a872d9e1a0aed550ed12f4268c1cb0f89ef17509dd7de2f98c59685fb6d63e1.exe
    "C:\Users\Admin\AppData\Local\Temp\4a872d9e1a0aed550ed12f4268c1cb0f89ef17509dd7de2f98c59685fb6d63e1.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      PID:5056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FQRZN8O7\search[4].htm

    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Temp\tmpD7FC.tmp

    Filesize

    29KB

    MD5

    6a50966aca000e13526a4fbce0277390

    SHA1

    5961e7d4016f33d1d52dde5d83eba43f79050b03

    SHA256

    b72b29e235ddea6c302151f31c89426e276692de4afe801abdaca06d68dc9319

    SHA512

    f310ff1eb2b9e965ee70a8abfded421d5be3dcdfe8fbb9aaaefcf76daaf8f8f6506c702833d91377c245e30b4d3845a711b3b1e70d9f86c2ad182f3a29b52c93

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    1d920998480441901087f22857c5d352

    SHA1

    fb5cdb112c5f704b85eb93a901619d5593acc4aa

    SHA256

    6682ca38d30029c99dbe53eb018445b72460f3a15a4443736a63c2083f5149fe

    SHA512

    9c07fa02cda935fa5443d6eae0c060430651a8e062045a0a9208e1859e23b11a2a5de5693958e6a682e2f1459be7e5311d1b674b8c1e951fae9ec22682ccfed4

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    320B

    MD5

    930898123f9cc922d45f218a5ff71803

    SHA1

    640e47df97729b371bc4d508dd897614a58a7f3d

    SHA256

    7ea424d6d26b4d72b2f1d5b0f2a4495963a22f7102de4e8a4d4f7a9953381ed1

    SHA512

    26056593b1fb4e03f17d4611b415a1b133812140257f4ed01df9b4b38078660b4bff52921e3cd49831a063e623716d6fb89fa082de648af2d763322ddaa66d06

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/2424-39-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2424-0-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2424-167-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2424-155-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2424-13-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/2424-50-0x0000000000500000-0x0000000000510200-memory.dmp

    Filesize

    64KB

  • memory/5056-38-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-40-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-16-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-15-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-21-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-51-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-33-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-28-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-156-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-5-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-26-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-168-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/5056-172-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB